Re: json-stream-read should validate json too

Show/hide message thread

json-stream-read should validate json too Duy Nguyen (21 Jan 2020 09:15 UTC)

Re: json-stream-read should validate json too Amirouche Boubekki (21 Jan 2020 10:47 UTC)

Re: json-stream-read should validate json too Duy Nguyen (21 Jan 2020 12:44 UTC)

Re: json-stream-read should validate json too Amirouche Boubekki (21 Jan 2020 13:46 UTC)

Re: json-stream-read should validate json too Duy Nguyen (23 Jan 2020 09:11 UTC)

Re: json-stream-read should validate json too Amirouche Boubekki (23 Jan 2020 19:12 UTC)

Re: json-stream-read should validate json too Amirouche Boubekki (23 Jan 2020 19:24 UTC)

Maximum nesting level limit and efficiency (Re: json-stream-read should validate json too) Amirouche Boubekki (23 Jan 2020 18:54 UTC)

Re: Maximum nesting level limit and efficiency (Re: json-stream-read should validate json too) Duy Nguyen (24 Jan 2020 01:38 UTC)

Re: json-stream-read should validate json too Amirouche Boubekki (23 Jan 2020 19:16 UTC)

Re: json-stream-read should validate json too Amirouche Boubekki 23 Jan 2020 19:24 UTC

> For small json structures, speed does not really
> matter because it won't take long either way (unless you have to
> process zillions of small json structures).

When one does receive json from untrusted source, it must validate it
*and* apply some limits to not open the door to DOS attacks via an OOM
kill or interperter crash or something.

They are tiny crafted xml files that can lead to OOM:
https://en.wikipedia.org/wiki/Billion_laughs_attack